An issue exists where an authenticated local user can submit crafted `waypoint.name` and `waypoint.icon` values. These values are interpolated into an innerHTML template in web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts without HTML encoding or icon validation. This allows a victim viewing the elevation profile to execute an attacker-controlled script in their browser, which can expose session data or perform actions in the victim's context. Additionally, federated waypoints can deliver these malicious fields across instances, removing the requirement for the attacker to have a local account on the receiving instance.